0

Something is mysteriously changing one of my environment variables on my Win 7 system. I've followed the guidance in this thread, and tracked down the culprit... to svchost.exe. Process Explorer seems to indicate that that thread of svchost.exe is running the Group Policy Client (gpsvc). Any thoughts about how to track down why gpsvc is changing this environment variable, and how to stop it from doing so?

Thanks in advance...

A registry value was modified.

Subject:
    Security ID:        SYSTEM
    Account Name:       machine$
    Account Domain:     mydomain
    Logon ID:       0xfff

Object:
    Object Name:        \REGISTRY\USER\S-1-5-21-1657032316-61167162-621696214-25666\Environment
    Object Value Name:  R_LIBS
    Handle ID:      0x16c
    Operation Type:     Existing registry value modified

Process Information:
    Process ID:     0x474
    Process Name:       C:\Windows\System32\svchost.exe

Change Information:
    Old Value Type:     REG_SZ
    Old Value:      D:\Program Files\R_libs
    New Value Type:     REG_SZ
    New Value:      z:\R
Improve this question

1 Answer 1

Reset to default
1

If your environment variable is set by a group policy setting, try to run in a priviledged command prompt :

gpupdate /r /z > somefile.txt && notepad somefile.txt

Then search inside the text file for your environment variable.

I am not sure if the result are the same but you may also try :

gpupdate /h report.html && start report.html

Then search inside in your browser for the environment variable.

Improve this answer
7
  • Thanks @rebrec. I can't see anything referencing environment variables, or any of the registry references touching the environment variables, there. Any other thoughts?
    – Alexander Shenkin
    Mar 16, 2018 at 9:33
  • can you change back your environment variable, then run gpupdate /force and see if the variable is modified again ?
    – rebrec
    Mar 16, 2018 at 12:04
  • yep, that changed it...
    – Alexander Shenkin
    Mar 16, 2018 at 16:10
  • umm in fact, it seems that rsop.msc is deprecated... can you try in a priviledged command prompt gpresult /r /z > somefile.txt and then open that file and search for the occurence of your environment variable ? You can also try gpresult /h somefile.html && notepad somefile.html and then search for the variable again.
    – rebrec
    Mar 16, 2018 at 20:23
  • Thanks rebrec. gpresult /r /z came up with nothing, but gpresult /h shows that R_LIBS is set in the group policy preferences (user configuration -> references -> environment variables): i.imgur.com/FpFEobP.png . I've been poking around, but can't find a way to access those preferences. Any thoughts? If it's something administered by the IT staff at a domain level, I can ping them about it... Thanks again...
    – Alexander Shenkin
    Mar 19, 2018 at 10:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .